red-flights

Search red eye flights, overnight flights and late-night departures with after-midnight arrival deals. Also supports: flight booking, hotel reservation, trai...

Before enabling/using this skill: 1) Verify the authenticity of the flyai CLI package (@fly-ai/flyai-cli) on the npm registry and confirm it is the official client for the service the skill claims to use (the skill mentions 'Fliggy' but the CLI publisher is different). 2) Avoid automatic sudo/global installs — prefer manual inspection and installing in a sandbox or using a non-global/local install if possible. 3) Inspect the flyai-cli source or documentation (network endpoints, data sent) to ensure it doesn't exfiltrate sensitive data. 4) Be aware the skill will write an execution log file containing your queries; decide if storing that data locally is acceptable and where it will be written. 5) If you plan to complete bookings, confirm how authentication and payment are handled and whether any credentials will be required later. If you cannot verify the CLI/package provenance, treat this skill as untrusted.

Type: OpenClaw Skill Name: red-flights Version: 3.2.0 The skill is a flight search tool that relies on a third-party CLI (@fly-ai/flyai-cli). It is classified as suspicious because it constructs shell commands using unvalidated user input (e.g., in SKILL.md and references/playbooks.md), which presents a shell injection risk. Additionally, it instructs the agent to perform global package installations, including the use of 'sudo' in fallbacks.md, which are high-privilege operations that could be abused if the target package or the command construction is compromised.